Patching and Vulnerabilities

JupyterHub
1

In jupyterhub 5.2.1 there seems to be the following vulnerability:
npm ip Version1.1.5
CVE-2023-42282
File location in the container: /usr/share/nodejs/ip/package.json

This is currently fixed in versions1.1.9, 2.0.1

Has anyone else come across this?
If so, how did you fix it?

Note: I fixed it by upgrading nodejs to 20.x.
That said, I am curious if others have noticed this and how they have solved it.

My fix:
I rebuilt the container removing nodejs and installing version 20.

Steps: (From my Dockerfile)
RUN curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
RUN apt remove nodejs -y
RUN apt update
RUN apt autoremove -y
RUN apt install nodejs -y
RUN npm ls -g

2

This appears to not be an issue in JupyterHub codebase, nor in JupyterHub dependency. The only connection with JupyterHub I could think of is that for (an unknown to me) reason this package was included in a container image that you used. There is to little information to make this actionable. In future, please mind that there are dedicated ways to report security vulnerabilities if you come by any.

1 Like
3

Thanks. Yes, this is limited to the image I pulled from Docker hub:
https://hub.docker.com/r/jupyterhub/jupyterhub (Tag 5.2.1)

Question: Are you able to direct me to the correct way to report security vulnerabilities Jupyterhub?

4

You can report secvulns at Security Overview · jupyterhub/jupyterhub · GitHub

However we wouldn’t class an out-of-date NPM package as a secvuln unless there’s a way to exploit it. A lot of packages are only partially used, or are brought in as dependencies of other packages without being used at runtime.

We’ve got some ongoing work to build our Docker images independently of JupyterHub releases:

1 Like